I assume everyone else who checks their Mod Sec logs will see that almost all attacks are coming in from compromised servers. I think it's easy to see why when you look at the php and apache version usage online. http://w3techs.com/technologies/details/ws-apache/all/all 3.2% are using Apache 1!