[ChrisMcQuillan]

Something someone suggested to me was to change permissions on the affected files to 444 from 644. I certainly haven't received an attack since doing this (although, this does coincide with being moved servers).