EVOLUTION ERP — WEB FORENSICS ====================================================================== Access log : /var/log/apache2/domlogs/my.evolutionerp.com.au-ssl_log Error log : /var/log/apache2/error_log Date : 27/Jul/2026 Window : 00:00 — 23:59 Mode : digest Generated : 2026-07-27 18:14:37 AEST on server2.coscom.com.au ====================================================================== 1. TRAFFIC SHAPE ====================================================================== Total requests in window : 164666 Application requests : 162954 (assets/static excluded) Distinct client IPs : 442 Busiest minutes (requests | distinct IPs): 07:31 704 req 9 ip ############################################# 15:38 662 req 13 ip ########################################## 11:06 605 req 9 ip ###################################### 09:20 585 req 13 ip ##################################### 13:19 578 req 12 ip #################################### 15:33 536 req 10 ip ################################## 15:21 535 req 11 ip ################################## 12:15 531 req 13 ip ################################# 13:54 513 req 12 ip ################################ 15:18 498 req 9 ip ############################### 15:39 493 req 11 ip ############################### 12:28 480 req 11 ip ############################## 13:01 475 req 11 ip ############################## 11:32 464 req 13 ip ############################# 14:28 444 req 12 ip ############################ 14:14 443 req 11 ip ############################ 13:56 440 req 16 ip ############################ 13:10 439 req 14 ip ############################ 14:13 436 req 11 ip ########################### 12:17 435 req 12 ip ########################### 14:59 435 req 11 ip ########################### 14:01 434 req 12 ip ########################### 14:42 420 req 10 ip ########################## 09:26 418 req 7 ip ########################## 12:43 414 req 11 ip ########################## Hourly totals: 00:00 131 01:00 126 02:00 366 03:00 350 04:00 950 05:00 1741 06:00 5006 07:00 11016 08:00 13035 09:00 15833 10:00 14987 11:00 17497 12:00 17311 13:00 18589 14:00 18317 15:00 16258 16:00 9830 17:00 2734 18:00 589 ====================================================================== 2. HTTP STATUS / ERRORS ====================================================================== 200 150040 304 8618 302 2945 404 2931 500 101 206 13 403 8 421 7 301 3 5xx responses: 101 5xx by endpoint: 69 500 /functions.php?call=heartbeat 3 500 /quoteditsave.php?call=getTheQuotes 3 500 /mfreqsave.php 3 500 /index.php?page=quotedit 2 500 /quoteditsave.php 2 500 /print.php 2 500 /index.php?page=quotereg 2 500 //functions.php?call=heartbeat 2 500 / 1 500 /registersave.php 1 500 /quoteditsave.php?call=getSite 1 500 /opportunityeditsave.php 1 500 /login.php 1 500 /inveditsave.php?call=getBomConflicts 1 500 /index.php?page=opportunityedit 1 500 /index.php?page=invedit 1 500 /index.php?page=activities 1 500 /billaddsave.php?call=sendToXero 1 500 /billaddsave.php 1 500 /app/ajax/selectFilterSingle.php 1 500 /app/ajax.php?call=getUserSetting 1 500 /app/ajax.php 5xx by minute: 07:28 1 09:21 2 10:02 34 10:05 49 10:06 1 10:53 1 12:15 1 13:58 1 14:29 1 17:52 9 17:53 1 ====================================================================== 3. REAL PAGE LOADS (page= parsed from the REQUEST URI only) ====================================================================== This is the number that matters. The old scripts reported the referer. 2326 jobedit 1658 quotedit 1150 activities 605 jobregister 599 invedit 526 quotereg 518 mfshoporderdetail 439 purchaseadd 437 mfreqedit 349 opportunityedit 291 inventory 278 pickingedit 231 invoiceadd 225 dispatchedit 183 opportunities 142 clientedit 140 purchasereg 115 billadd 101 reqedit 94 siteedit 85 invedithist 81 clientlist 73 mfshoporders 68 jobadd 50 report (any request carrying page= in its own URI, incl. AJAX handlers): 2369 jobedit 1688 quotedit 1157 activities 654 1 615 jobregister 605 invedit 530 quotereg 519 mfshoporderdetail 447 purchaseadd 437 mfreqedit 351 opportunityedit 295 inventory 278 pickingedit 272 2 241 dispatchedit 231 invoiceadd 184 opportunities 142 clientedit 141 purchasereg 115 billadd 109 siteedit 101 reqedit 86 invedithist 86 3 81 clientlist ====================================================================== 4. SCREENS USERS HAD OPEN (page= from the REFERER — concurrency proxy) ====================================================================== requests | distinct IPs — a high IP count = that many people sitting on it. join: /tmp/erpforensic.WF1rBr/refreq.tsv:51: is not sorted: jobregister 6799 join: /tmp/erpforensic.WF1rBr/refip.tsv:55: is not sorted: login 3 40754 req 114 ip jobedit 31757 req 95 ip quotedit 6834 req 7 ip purchaseadd 6437 req 10 ip opportunityedit 5689 req 18 ip quotereg 4689 req 10 ip invedit 3750 req 5 ip mfshoporderdetail 3638 req 10 ip inventory 3578 req 6 ip dispatchedit 3511 req 7 ip invoiceadd 3373 req 10 ip activities 2474 req 5 ip mfreqedit 2412 req 5 ip siteedit 2261 req 9 ip opportunities 2017 req 5 ip purchasereg 1795 req 10 ip clientedit 1079 req 7 ip billadd 1044 req 7 ip pickingedit 984 req 5 ip invedithist 864 req 10 ip clientlist 842 req 3 ip mfstatus 730 req 7 ip report 715 req 3 ip reqedit 668 req 3 ip inveditsub 509 req 3 ip mfshoporders ====================================================================== 5. TOP APPLICATION ENDPOINTS (assets excluded, ids collapsed) ====================================================================== 50417 /functions.php?call=heartbeat 23999 /app/ajax.php?call=getUserSetting 6834 /plugins/csvexporter/plugin.php 4144 /app/ajax/selectFilterSingle.php 3495 /app/ajax.php 3456 /assets/js/modules/timesheetTimerApplet.js 2248 //functions.php?call=heartbeat 2134 /app/ajax/selectFilter.php?call=filterinv 2088 /index.php?page=jobedit 1730 /clienteditsave.php?call=getCategoryDiscounts 1729 /clienteditsave.php?call=getSettings 1637 /index.php?page=quotedit 1590 /jobeditsave.php?call=filter 1574 //app/ajax.php?call=getUserSetting 1505 /logsave.php?call=getHistory 1114 /index.php?page=activities 1061 /plugins/fencecosting/plugin.php 1011 /plugins/fensa/fensa-ajax.php 924 /quoteditsave.php?call=getTheQuotes 777 /plugins/fencecosting/plugin.js 772 /assets/css/bootstrap-5.2.0-dist/css/bootstrap.min.css 724 /inveditsave.php?call=fetch_inventory 722 /app/ajax.php?call=ts 661 /app/ajax/selectFilter.php?call=filterstaffandcontractors 611 /quoteditsave.php 603 /assets/images/logo_wide_website.png 594 /index.php?page=invedit 589 /assets/css/material-symbols-rounded.woff2 580 /index.php?page=jobregister 569 /app/ajax/selectFilter.js 528 /index.php 512 /index.php?page=mfshoporderdetail 510 /index.php?page=quotereg 486 /quoteditsave.php?call=loadConfigureModal 486 /quoteditsave.php?call=checkForBOMAlternates 481 /itemModify.php?call=getInvMFMeta 478 /itemModify.php?call=getBOM 462 /assets/jscripts/sortable-master/sortable.min.js 462 /assets/css/bootstrap-5.2.0-dist/js/bootstrap.bundle.min.js 446 /quoteditsave.php?call=addLineItem ====================================================================== 6. EXPENSIVE ENDPOINT CLASSES ====================================================================== -- reports / exports / print / PDF: 6834 /plugins/csvexporter/plugin.php 445 /app/ajax.php?call=getUserSetting 359 /functions.php?call=heartbeat 336 /print.php 323 /plugins/csvexporter/plugin.js 297 /assets/js/modules/printdiv.js 247 //plugins/csvexporter/plugin.php 244 /download.php 167 /assets/images/pdf.png 155 /docs/reporting/images/inventory/demand-deficit.png 154 /docs/reporting/images/inventory/min-max-reorder.png 84 /docs/purchasing/images/purchase-orders/po-print-email.png 79 /docs/reporting/images/purchasing/purchasing-by-job.png 78 /docs/reporting/images/timesheets/monthly-billing.png 78 /docs/reporting/images/timesheets/effective-bill-rate.png 78 /docs/reporting/images/sales/invoicing-advanced.png 78 /docs/reporting/images/purchasing/supplier-spend.png 78 /docs/reporting/images/purchasing/open-po-commitments.png 78 /docs/reporting/images/projects/project-billable-items.png 78 /docs/reporting/images/inventory/stock-movement-ledger.png 78 /docs/reporting/images/inventory/product-sales-performance.png 78 /docs/reporting/images/inventory/item-history.png 78 /docs/reporting/images/inventory/bom-restocking.png 78 /docs/reporting/images/inventory/bom-detail.png 57 /companies/304-1705884103/files/Forms%20and%20Templates/1684375278.html?page=1 -- register/grid filter handlers (SQL_CALC_FOUND_ROWS + LIKE scans): 23999 /app/ajax.php?call=getUserSetting 2134 /app/ajax/selectFilter.php?call=filterinv 1730 /clienteditsave.php?call=getCategoryDiscounts 1729 /clienteditsave.php?call=getSettings 1590 /jobeditsave.php?call=filter 1574 //app/ajax.php?call=getUserSetting 1505 /logsave.php?call=getHistory 924 /quoteditsave.php?call=getTheQuotes 724 /inveditsave.php?call=fetch_inventory 661 /app/ajax/selectFilter.php?call=filterstaffandcontractors 481 /itemModify.php?call=getInvMFMeta 478 /itemModify.php?call=getBOM 362 /purchaseaddsave.php?call=fetch 341 /quoteditsave.php?call=getKit 241 /opportunityeditsave.php?call=getTheLeads 234 //clienteditsave.php?call=getSettings 234 //clienteditsave.php?call=getCategoryDiscounts 231 //logsave.php?call=getHistory 224 /quoteditsave.php?call=getSupplier 217 /mfreqsave.php?call=fetch 209 /jobeditsave.php?call=fetch_callup 177 /app/ajax/contactFilter.php?call=filterClients 121 /clienteditsave.php?call=getClients 111 /jobeditsave.php?call=fetch_inventory 108 /itemModify.php?call=getJobInvFiles -- global search: 12 /index.php?page=globalsearch 12 /functions.php?call=heartbeat 10 /plugins/csvexporter/plugin.php 9 /index.php?page=quotedit 9 /app/ajax.php?call=getUserSetting 7 /assets/js/modules/timesheetTimerApplet.js 6 /globalsearch.php 3 /assets/js/modules/filterlist.js 3 /assets/jscripts/DataTables/datatables.min.js 3 /assets/jscripts/DataTables/datatables.min.css 1 /themes/default/theme.css 1 /plugins/csvexporter/plugin.js 1 /index.php?page=jobedit 1 /globalsearch.php?call=global_search_filter 1 /assets/jscripts/sortable-master/sortable.min.js -- cron / plugin entry points: 6834 /plugins/csvexporter/plugin.php 1061 /plugins/fencecosting/plugin.php 1011 /plugins/fensa/fensa-ajax.php 777 /plugins/fencecosting/plugin.js 323 /plugins/csvexporter/plugin.js 270 /assets/js/tinymce/plugins/table/plugin.min.js 270 /assets/js/tinymce/plugins/lists/plugin.min.js 270 /assets/js/tinymce/plugins/code/plugin.min.js 251 /assets/js/tinymce/plugins/preview/plugin.min.js 247 //plugins/csvexporter/plugin.php 232 /plugins/pipe/pipetopost2.js 118 /assets/js/tinymce/plugins/link/plugin.min.js 73 /plugins/fencecosting/plugin.css 66 /plugins/pipe/pipetopostsave.php?call=getKit 59 /assets/js/tinymce/plugins/image/plugin.min.js 59 /assets/js/tinymce/plugins/fullscreen/plugin.min.js 48 //plugins/fencecosting/plugin.php 46 /assets/js/tinymce/plugins/anchor/plugin.min.js 40 /plugins/csvexporter/plugin.css 37 /plugins/pipe/pipetopostsave.php?call=getItem 36 /plugins/pipe/pipetopostsave.php?call=getProductionCost 36 /plugins/pipe/pipetopostsave.php?call=getPipeFull 36 //plugins/pipe/pipetopost2.js 32 /plugins/costupdater/plugin.js 31 /plugins/costupdater/plugin.css ====================================================================== 7. RETRY AMPLIFICATION (same IP hitting the same endpoint repeatedly) ====================================================================== CGI timeout -> user reloads -> death spiral. >=5 in the window is suspicious. 25169 203.54.180.238 /functions.php?call=heartbeat 10157 103.104.165.99 /functions.php?call=heartbeat 9878 203.54.180.238 /app/ajax.php?call=getUserSetting 5216 103.104.165.99 /app/ajax.php?call=getUserSetting 3679 203.54.180.238 /plugins/csvexporter/plugin.php 3387 150.228.243.123 /functions.php?call=heartbeat 3106 182.239.240.254 /functions.php?call=heartbeat 2566 182.239.240.254 /app/ajax.php?call=getUserSetting 2380 147.161.213.78 /functions.php?call=heartbeat 2001 150.228.243.123 /app/ajax.php?call=getUserSetting 1857 103.104.165.99 /plugins/csvexporter/plugin.php 1815 203.54.180.238 /app/ajax/selectFilterSingle.php 1567 203.54.180.238 /app/ajax.php 1516 180.181.236.49 /functions.php?call=heartbeat 1424 203.54.180.238 /assets/js/modules/timesheetTimerApplet.js 920 203.54.180.238 /plugins/fensa/fensa-ajax.php 920 1.145.84.81 /functions.php?call=heartbeat 901 203.54.180.238 //functions.php?call=heartbeat 892 180.181.236.49 /app/ajax.php?call=getUserSetting 868 203.54.180.238 /app/ajax/selectFilter.php?call=filterinv 823 203.54.180.238 /clienteditsave.php?call=getSettings 823 203.54.180.238 /clienteditsave.php?call=getCategoryDiscounts 794 103.104.165.99 /app/ajax.php 780 103.104.165.99 /app/ajax/selectFilterSingle.php 744 203.54.180.238 /index.php?page=jobedit ====================================================================== 8. PER-DOCUMENT-ID BREAKDOWN (retry storm vs many distinct records) ====================================================================== -- jobedit (2369 requests carrying page=jobedit) 65 id=26371 41 id=11755 33 id=11867 29 id=28913 29 id=11845 26 id=28906 26 id=11871 26 id=11850 26 id=11740 24 id=11874 23 id=28982 23 id=11693 22 id=11859 22 id=11838 21 id=11858 -- quotedit (1688 requests carrying page=quotedit) 74 - 41 quoteid=77665 30 quoteid=36347 28 quoteid=36280 26 quoteid=2223 18 quoteid=77704 18 quoteid=77552 17 quoteid=77727 16 quoteid=36350 15 quoteid=3250 13 quoteid=35942 12 quoteid=77721 12 quoteid=77700 12 quoteid=77691 12 quoteid=77687 -- invedit (605 requests carrying page=invedit) 13 id=6887 11 id=7811 11 id=4739 11 id=1177 10 id=4903 9 id=5950 8 id=7954 8 id=6356 8 id=5959 8 id=118 8 id=11085 7 id=5952 7 id=5602 7 id=2086 6 id=7700 -- purchaseadd (447 requests carrying page=purchaseadd) 21 - 12 purchaseid=13871 12 purchaseid=13814 11 purchaseid=1184 10 purchaseid=13870 9 purchaseid=13865 9 purchaseid=11100 7 purchaseid=11099 6 purchaseid=3388 6 purchaseid=13867 6 purchaseid=12547 6 purchaseid=11096 6 purchaseid=11086 6 purchaseid=10844 5 purchaseid=3384 -- dispatchedit (241 requests carrying page=dispatchedit) 10 dispatchid=16112 9 dispatchid=33366 7 dispatchid=33367 7 dispatchid=16115 6 dispatchid=33348 6 dispatchid=16117 5 dispatchid=3660 5 dispatchid=33230 5 dispatchid=15739 4 dispatchid=5030 4 dispatchid=3655 4 dispatchid=33343 4 dispatchid=33331 4 dispatchid=16108 4 dispatchid=16107 -- pickingedit (278 requests carrying page=pickingedit) 278 - ====================================================================== 9. HEAVIEST RESPONSES BY BYTES (big buffered result sets) ====================================================================== 13527.2 KB 10:36 200 /download.php?id=166754 9994.1 KB 09:22 200 /download.php?id=166759&inline=1 8821.1 KB 11:21 200 /download.php?id=21991&inline=1 8355.8 KB 06:37 200 /download.php?id=287023 8001.6 KB 14:17 200 /download.php?id=279110 7008.6 KB 07:47 200 /download.php?id=164303 6902.9 KB 07:49 200 /download.php?id=164305 6387.9 KB 12:47 200 /download.php?id=278875 6345.6 KB 08:14 200 /download.php?id=163794&inline=1 4853.4 KB 07:21 200 /assets/css/material-symbols-rounded.woff2 4853.4 KB 14:17 200 /assets/css/material-symbols-rounded.woff2 4853.4 KB 14:59 200 /assets/css/material-symbols-rounded.woff2 4853.4 KB 15:00 200 /assets/css/material-symbols-rounded.woff2 4853.4 KB 15:43 200 /assets/css/material-symbols-rounded.woff2 4853.4 KB 15:51 200 /assets/css/material-symbols-rounded.woff2 4851.6 KB 00:33 200 /assets/css/material-symbols-rounded.woff2 4851.6 KB 03:04 200 /assets/css/material-symbols-rounded.woff2 4851.6 KB 04:27 200 /assets/css/material-symbols-rounded.woff2 4851.6 KB 04:46 200 /assets/css/material-symbols-rounded.woff2 4851.6 KB 05:48 200 /assets/css/material-symbols-rounded.woff2 4851.6 KB 06:17 200 //assets/css/material-symbols-rounded.woff2 4851.6 KB 06:45 200 /assets/css/material-symbols-rounded.woff2 4851.6 KB 06:48 200 /assets/css/material-symbols-rounded.woff2 4851.6 KB 06:48 200 /assets/css/material-symbols-rounded.woff2 4851.6 KB 06:54 200 /assets/css/material-symbols-rounded.woff2 Total bytes served in window: 3166.8 MB ====================================================================== 10. TOP CLIENT IPs ====================================================================== 70225 203.54.180.238 33575 103.104.165.99 14110 182.239.240.254 11204 150.228.243.123 4884 180.181.236.49 3483 124.168.94.138 3258 147.161.213.78 2655 120.150.225.142 2501 118.127.40.55 2295 165.225.114.214 2081 1.145.84.81 1533 101.166.96.210 1486 159.196.149.164 1355 49.183.11.160 835 14.201.22.76 835 1.141.176.34 759 203.40.84.196 699 120.21.56.209 508 120.19.190.35 345 165.225.227.59 303 1.145.77.150 296 20.48.234.177 269 35.182.150.8 269 15.156.91.175 266 20.79.250.162 Bot/scanner traffic: 2023 requests 23 52.167.144.166 /index.php?page=activities 23 40.77.167.14 /index.php?page=activities 22 52.167.144.25 /index.php?page=activities 22 52.167.144.160 /index.php?page=activities 21 52.167.144.204 /index.php?page=activities 18 52.167.144.232 /index.php?page=activities 18 52.167.144.213 /index.php?page=activities 17 40.77.167.24 /index.php?page=activities 16 52.167.144.183 /index.php?page=activities 16 52.167.144.172 /index.php?page=activities 16 40.77.167.57 /index.php?page=activities 16 40.77.167.45 /index.php?page=activities 15 52.167.144.209 /index.php?page=activities 15 52.167.144.204 /index.php?page=quotedit 15 40.77.167.74 /index.php?page=activities ====================================================================== 11. APACHE ERROR LOG (PHP OOM, CGI timeouts, fatals) ====================================================================== Error-log lines in window: 5865 -- signature counts: 23 Allowed memory size 84 Timeout waiting for output 6 MySQL server has gone away 33 Fatal error -- PHP memory-exhaustion by script: 11 in /home/evolution/public_html/wp.evolutionerp.com.au/wp-includes/class-wpdb.php on line 2351 6 in /home/evolution/public_html/wp.evolutionerp.com.au/wp-content/plugins/ninja-forms/vendor/composer/ClassLoader.php on line 576 2 in /home/evolution/public_html/wp.evolutionerp.com.au/wp-content/plugins/wordpress-seo/lib/orm.php on line 1669 2 in /home/evolution/public_html/wp.evolutionerp.com.au/wp-content/plugins/wordpress-seo/lib/model.php on line 1 1 in /home/speedlin/public_html/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib/storage/file.php on line 658 1 in /home/evolution/public_html/wp.evolutionerp.com.au/wp-content/plugins/wordpress-seo/lib/orm.php on line 675 -- CGI timeouts by script: 4 //my.evolutionerp.com.au/index.php 1 //portal.evolutionerp.com.au/index.php -- errors by minute: 00:04 2 00:08 4 00:09 1 00:11 2 00:12 4 00:13 5 00:18 1 00:20 2 00:21 10 00:22 10 00:23 2 00:24 3 00:30 1 00:31 2 00:32 8 00:35 3 00:36 2 00:38 1 00:42 4 00:45 10 00:46 2 00:47 1 00:50 3 00:54 6 00:56 1 01:00 4 01:01 11 01:02 10 01:03 2 01:04 1 01:05 2 01:06 4 01:12 6 01:13 2 01:14 2 01:15 1 01:18 1 01:19 6 01:21 8 01:22 1 -- sample lines (first 15): [Mon Jul 27 00:04:06.865561 2026] [authz_core:error] [pid 213601:tid 213601] [client 91.122.53.173:40580] AH01630: client denied by server configuration: /home/alison/public_html/.env [Mon Jul 27 00:04:23.969623 2026] [authz_core:error] [pid 213895:tid 213895] [client 31.59.129.193:46278] AH01630: client denied by server configuration: /home/tubesupplies/public_html/.aws, referer: http://tubesupplies. [Mon Jul 27 00:08:20.422834 2026] [access_compat:error] [pid 214217:tid 214217] [client 143.244.57.118:33658] AH01797: client denied by server configuration: /home/corpkicks/public_html/xmlrpc.php [Mon Jul 27 00:08:26.592948 2026] [access_compat:error] [pid 214217:tid 214217] [client 143.244.57.118:33658] AH01797: client denied by server configuration: /home/corpkicks/public_html/xmlrpc.php [Mon Jul 27 00:08:28.785906 2026] [authz_core:error] [pid 214254:tid 214254] [client 20.79.29.209:16370] AH01630: client denied by server configuration: /home/olympic/public_html/wp-content/a.php [Mon Jul 27 00:08:33.952121 2026] [authz_core:error] [pid 214254:tid 214254] [client 20.79.29.209:16370] AH01630: client denied by server configuration: /home/olympic/public_html/wp-content/plugins/admin.php [Mon Jul 27 00:09:14.747768 2026] [authz_core:error] [pid 214254:tid 214254] [client 20.79.29.209:16370] AH01630: client denied by server configuration: /home/olympic/public_html/wp-content/uploads/index.php [Mon Jul 27 00:11:35.858769 2026] [authz_core:error] [pid 214254:tid 214254] [client 20.79.29.209:16370] AH01630: client denied by server configuration: /home/olympic/public_html/wp-includes/sodium_compat/composer.json [Mon Jul 27 00:11:55.909062 2026] [authz_core:error] [pid 214254:tid 214254] [client 20.79.29.209:16370] AH01630: client denied by server configuration: /home/olympic/public_html/wp-includes/l10n/error_log [Mon Jul 27 00:12:38.152458 2026] [authz_core:error] [pid 214196:tid 214196] [client 20.79.29.209:16272] AH01630: client denied by server configuration: /home/olympic/public_html/wp-includes/block-patterns/error_log [Mon Jul 27 00:12:44.692594 2026] [authz_core:error] [pid 215729:tid 215729] [client 191.232.199.39:62489] AH01630: client denied by server configuration: /home/alison/public_html/wp-includes/Requests/library/error_log [Mon Jul 27 00:12:50.861350 2026] [authz_core:error] [pid 215729:tid 215729] [client 191.232.199.39:62489] AH01630: client denied by server configuration: /home/alison/public_html/wp-includes/sitemaps/providers/error_log [Mon Jul 27 00:12:51.159968 2026] [authz_core:error] [pid 215729:tid 215729] [client 191.232.199.39:62489] AH01630: client denied by server configuration: /home/alison/public_html/wp-includes/block-bindings/error_log [Mon Jul 27 00:13:07.969013 2026] [authz_core:error] [pid 214254:tid 214254] [client 20.79.29.209:16370] AH01630: client denied by server configuration: /home/olympic/public_html/wp-content/themes/index.php [Mon Jul 27 00:13:09.187499 2026] [authz_core:error] [pid 215729:tid 215729] [client 191.232.199.39:62489] AH01630: client denied by server configuration: /home/alison/public_html/wp-content/uploads/2024/index.php ====================================================================== 12. HEURISTIC READ ====================================================================== Peak minute : 07:31 (704 requests, 9 distinct IPs) 5xx in window : 101 Bot requests : 2023 Heartbeat POSTs : 52665 <- one per open tab per ~15s; divide by window minutes for a concurrency estimate. Next steps: * Zoom the spike: ./forensic-web.sh -f 07:31 -t 07:36 * Host/DB side: ./forensic-host.sh * Leave running: nohup ./forensic-watch.sh > /dev/null 2>&1 & ====================================================================== Report written to: forensic-web_27-Jul-2026_0000-2359.txt ======================================================================