diff --git a/modules/module-php.sh b/modules/module-php.sh
index e30d2bd..381623d 100644
--- a/modules/module-php.sh
+++ b/modules/module-php.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 FIREWALL="/opt/firewall/firewall.sh"
 ATTACK="module-php"
-PHP_SPAM=$(grep $2 $3 | grep -E ".php|cgi-bin|wp-content|wp-admin|wp-includes" | wc -l)
+PHP_SPAM=$(grep $2 $3 | grep $1 | grep -E ".php|cgi-bin|wp-content|wp-admin|wp-includes" | wc -l)
 if [[ $PHP_SPAM -gt 10 ]]; then
 	bash $FIREWALL ipBlockParser "$1"
 	bash $FIREWALL message "$ATTACK-$1"